--- a/mercurial/wireprotoserver.py Tue Mar 06 15:08:33 2018 -0800
+++ b/mercurial/wireprotoserver.py Wed Mar 07 16:02:24 2018 -0800
@@ -242,11 +242,7 @@
'over HTTP'))
return []
- # Assume commands with no defined permissions are writes /
- # for pushes. This is the safest from a security perspective
- # because it doesn't allow commands with undefined semantics
- # from bypassing permissions checks.
- checkperm(wireproto.permissions.get(cmd, 'push'))
+ checkperm(wireproto.commands[cmd].permission)
rsp = wireproto.dispatch(repo, proto, cmd)